| pf.os (126756) | pf.os (130151) |
|---|---|
| 1# $FreeBSD: head/etc/pf.os 126756 2004-03-08 22:03:29Z mlaier $ | 1# $FreeBSD: head/etc/pf.os 130151 2004-06-06 11:46:29Z schweikh $ |
| 2# $OpenBSD: pf.os,v 1.10 2003/09/06 01:37:07 frantzen Exp $ 3# passive OS fingerprinting 4# ------------------------- 5# 6# SYN signatures. Those signatures work for SYN packets only (duh!). 7# 8# (C) Copyright 2000-2003 by Michal Zalewski <lcamtuf@coredump.cx> 9# (C) Copyright 2003 by Mike Frantzen <frantzen@w4g.org> --- 349 unchanged lines hidden (view full) --- 35960352:128:1:48:M*,N,N,S: Windows:98::Windows 98 36060352:128:1:64:M*,N,W2,N,N,T0,N,N,S: Windows:98::Windows 98 361 362# Windows NT 4.0 - need more: 363 36464512:128:1:44:M1414: Windows:NT:4.0:Windows NT 4.0 SP6a 3658192:128:1:44:M*: Windows:NT:4.0:Windows NT 4.0 (older) 3666144:128:1:52:M*,W0,N,S,N,N: Windows:NT:4.0:Windows NT 4.0 (RFC1323) | 2# $OpenBSD: pf.os,v 1.10 2003/09/06 01:37:07 frantzen Exp $ 3# passive OS fingerprinting 4# ------------------------- 5# 6# SYN signatures. Those signatures work for SYN packets only (duh!). 7# 8# (C) Copyright 2000-2003 by Michal Zalewski <lcamtuf@coredump.cx> 9# (C) Copyright 2003 by Mike Frantzen <frantzen@w4g.org> --- 349 unchanged lines hidden (view full) --- 35960352:128:1:48:M*,N,N,S: Windows:98::Windows 98 36060352:128:1:64:M*,N,W2,N,N,T0,N,N,S: Windows:98::Windows 98 361 362# Windows NT 4.0 - need more: 363 36464512:128:1:44:M1414: Windows:NT:4.0:Windows NT 4.0 SP6a 3658192:128:1:44:M*: Windows:NT:4.0:Windows NT 4.0 (older) 3666144:128:1:52:M*,W0,N,S,N,N: Windows:NT:4.0:Windows NT 4.0 (RFC1323) |
| 367 | 367 |
| 368# Windows XP and 2000. Most of the signatures that were 369# either dubious or non-specific (no service pack data) 370# were deleted and replaced with generics at the end. 371 37265535:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4, XP SP1 373%8192:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4, XP SP1 374S45:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4 375S6:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows XP SP1, 2000 SP4 --- 167 unchanged lines hidden (view full) --- 543 544*:128:1:52:M*,N,W0,N,N,S: @Windows:XP:RFC1323:Windows XP/2000 (RFC1323 no tstamp) 545*:128:1:52:M*,N,W0,N,N,S: @Windows:2000:RFC1323:Windows XP/2000 (RFC1323 no tstamp) 546*:128:1:64:M*,N,W0,N,N,T0,N,N,S: @Windows:XP:RFC1323:Windows XP/2000 (RFC1323) 547*:128:1:64:M*,N,W0,N,N,T0,N,N,S: @Windows:2000:RFC1323:Windows XP/2000 (RFC1323) 548*:128:1:64:M*,N,W*,N,N,T0,N,N,S: @Windows:XP:RFC1323:Windows XP (RFC1323, w+) 549*:128:1:48:M*,N,N,S: @Windows:XP::Windows XP/2000 550*:128:1:48:M*,N,N,S: @Windows:2000::Windows XP/2000 | 368# Windows XP and 2000. Most of the signatures that were 369# either dubious or non-specific (no service pack data) 370# were deleted and replaced with generics at the end. 371 37265535:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4, XP SP1 373%8192:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4, XP SP1 374S45:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows 2000 SP4 375S6:128:1:48:M*,N,N,S: Windows:2000:SP4:Windows XP SP1, 2000 SP4 --- 167 unchanged lines hidden (view full) --- 543 544*:128:1:52:M*,N,W0,N,N,S: @Windows:XP:RFC1323:Windows XP/2000 (RFC1323 no tstamp) 545*:128:1:52:M*,N,W0,N,N,S: @Windows:2000:RFC1323:Windows XP/2000 (RFC1323 no tstamp) 546*:128:1:64:M*,N,W0,N,N,T0,N,N,S: @Windows:XP:RFC1323:Windows XP/2000 (RFC1323) 547*:128:1:64:M*,N,W0,N,N,T0,N,N,S: @Windows:2000:RFC1323:Windows XP/2000 (RFC1323) 548*:128:1:64:M*,N,W*,N,N,T0,N,N,S: @Windows:XP:RFC1323:Windows XP (RFC1323, w+) 549*:128:1:48:M*,N,N,S: @Windows:XP::Windows XP/2000 550*:128:1:48:M*,N,N,S: @Windows:2000::Windows XP/2000 |
| 551 552 | |